Federated identity management with decentralized computing platforms

Abstract

Provided is a process that establishes user identities within a decentralized data store, like a blockchain. A user's mobile device may establish credential values within a trusted execution environment of the mobile device. Representations of those credentials may be generated on the mobile device and transmitted for storage in association with an identity of the user established on the blockchain. Similarly, one or more key-pairs may be generated or otherwise used by the mobile device for signatures and signature verification. Private keys may remain resident on the device (or known and input by the user) while corresponding public keys may be stored in association with the user identity on the blockchain. A private key is used to sign representations of credentials and other values as a proof of knowledge of the private key and credential values for authentication of the user to the user identity on the blockchain.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]The present application is a continuation-in-part of co-pending U.S. application Ser. No. 16 / 270,255, filed on 7 Feb. 2019, titled OUT-OF-BAND AUTHENTICATION BASED ON SECURE CHANNEL TO TRUSTED EXECUTION ENVIRONMENT ON CLIENT DEVICE, which claims the benefit of U.S. Provisional Patent Application 62 / 720,609 filed on 21 Aug. 2018, titled OUT-OF-BAND AUTHENTICATION BASED ON SECURE CHANNEL TO TRUSTED EXECUTION ENVIRONMENT ON CLIENT DEVICE, and claims the benefit of U.S. Provisional Patent Application 62 / 720,590 filed on 21 Aug. 2018, titled FEDERATED IDENTITY MANAGEMENT WITH DECENTRALIZED COMPUTING PLATFORMS, the entirety of each of the above noted applications being incorporated herein by reference.BACKGROUND1. Field[0002]The present disclosure relates generally to cybersecurity and, more specifically, to identity management techniques leveraging decentralized computing platforms.2. Description of the Related Art[0003]Many computer systems a...

AI Technical Summary

Problems solved by technology

Existing federated identity management techniques impose more friction on users and require more trust of developers than is desirable.

In the aggregate, these repeated requests can be frustrating and, in some cases, expand the attack surface of a user's identity with an excess of authentication sessions that could be potentially compromised.

Further, enterprises hosting federated identity management systems may be un-trusted by other enterprises wishing to authenticate users on such systems.

In some cases, the enterprises hosting identity management systems may be competitors of the other enterprises wishing to authenticate users with those types of systems, or developers may be concerned that even if an enterprise is currently trusted, subsequent management may be less reliable.

In addition, an enterprise using such systems for authentication services may be unable to receive authentication tokens for authenticating user access in the event of a federated identify management system outage of the hosting enterprise.

As a result, user experience associated with an enterprise may be affected by the reliance on third-party user authentication.

In this manner, such systems may supply additional factors by which additional confidence may be obtained regarding a user's identity, as merely compromising a user's username and password would not by itself afford access to secured resources.

Many existing out-of-band authentication techniques are potentially subject to vulnerabilities.

Examples include attacks that compromise the client computing device by which the user supplies the supplemental credentials in the out-of-band channel.

Some existing systems are potentially vulnerable to malicious code executing on the user's mobile device that, for example, capture user supplied credentials from system memory allocated to client-side authentication applications.

The result being that federated identity systems are further susceptible to those attacks described above that are applicable to out-of-band authentication, and the rewards of a successful attack for attackers are far greater than on an individual account basis.

Images